CVE-2026-68274 (GCVE-0-2026-68274)

Vulnerability from cvelistv5 – Published: 2026-08-10 12:01 – Updated: 2026-08-17 05:02
VLAI
Title
drm/xe/guc: Fix buffer overflow in steered register list allocation
Summary
In the Linux kernel, the following vulnerability has been resolved: drm/xe/guc: Fix buffer overflow in steered register list allocation The size calculation for the steered register extarray uses only the geometry DSS mask (g_dss_mask) to determine the number of entries to allocate: total = bitmap_weight(gt->fuse_topo.g_dss_mask, ...) * steer_reg_num; However, the filling loop uses for_each_dss_steering(), which iterates over for_each_dss(), defined as the union of g_dss_mask and c_dss_mask (geometry + compute DSS). On platforms with compute-only DSS bits, the loop writes past the allocated buffer, corrupting adjacent slab objects. This manifests as list_del corruption and SLUB redzone overwrites during drm_managed_release on device unbind, since the overflow corrupts the drmres list_head of neighboring allocations. Fix by computing the allocation size using the union of both DSS masks, matching the iteration pattern of for_each_dss_steering(). -- v2: - use bitmap_weighted_or() (Zhanjun) (cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b170d696c1e2226713471d810c63b1162335079f , < b485bfb45555163bfa5f565d6a3415fcb3035b02 (git)
Affected: b170d696c1e2226713471d810c63b1162335079f , < a9a020f3c11eba6573b699f9cf9245a51b025ade (git)
Affected: b170d696c1e2226713471d810c63b1162335079f , < 632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.13
Unaffected: 0 , < 6.13 (semver)
Unaffected: 6.18.44 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_capture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b485bfb45555163bfa5f565d6a3415fcb3035b02",
              "status": "affected",
              "version": "b170d696c1e2226713471d810c63b1162335079f",
              "versionType": "git"
            },
            {
              "lessThan": "a9a020f3c11eba6573b699f9cf9245a51b025ade",
              "status": "affected",
              "version": "b170d696c1e2226713471d810c63b1162335079f",
              "versionType": "git"
            },
            {
              "lessThan": "632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0",
              "status": "affected",
              "version": "b170d696c1e2226713471d810c63b1162335079f",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/gpu/drm/xe/xe_guc_capture.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.13"
            },
            {
              "lessThan": "6.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/xe/guc: Fix buffer overflow in steered register list allocation\n\nThe size calculation for the steered register extarray uses only the\ngeometry DSS mask (g_dss_mask) to determine the number of entries to\nallocate:\n\n  total = bitmap_weight(gt-\u003efuse_topo.g_dss_mask, ...) * steer_reg_num;\n\nHowever, the filling loop uses for_each_dss_steering(), which iterates\nover for_each_dss(), defined as the union of g_dss_mask and c_dss_mask\n(geometry + compute DSS). On platforms with compute-only DSS bits, the\nloop writes past the allocated buffer, corrupting adjacent slab objects.\n\nThis manifests as list_del corruption and SLUB redzone overwrites during\ndrm_managed_release on device unbind, since the overflow corrupts the\ndrmres list_head of neighboring allocations.\n\nFix by computing the allocation size using the union of both DSS masks,\nmatching the iteration pattern of for_each_dss_steering().\n\n--\nv2:\n- use bitmap_weighted_or() (Zhanjun)\n\n(cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is in the drm/xe GPU driver\u0027s GuC ADS/capture-list setup, reached only through local kernel device probe/GuC upload on the machine\u0027s own hardware; there is no network or remote-peer input anywhere on the path.\nAC:L - On any affected platform (one whose compute DSS mask contains bits outside the geometry DSS mask) the undersized allocation and the for_each_dss_steering() fill loop mismatch is fully deterministic, so the out-of-bounds write occurs reliably on every driver load without needing a race or a lucky memory layout.\nPR:L - The overflow happens in the xe driver\u0027s GuC initialization path, so an attacker needs only ordinary local access to a system with the affected Intel GPU present; no capability check or elevated privilege gates the corrupted code path itself.\nUI:N - No victim action is needed; the buffer overflow occurs automatically during xe_guc_ads_populate() at device probe, with no file to open, filesystem to mount, or user gesture involved.\nS:U - The out-of-bounds write corrupts kernel slab objects belonging to the same kernel security authority; there is no crossing of a VM, IOMMU, or sandbox boundary.\nC:H - The overflow overwrites adjacent slab objects including drmres list_head pointers, and such heap metadata corruption can be leveraged to make subsequent list operations dereference attacker-influenceable heap contents, so an information-disclosure primitive cannot be ruled out.\nI:H - This is a heap out-of-bounds write past the end of the drmm_kzalloc\u0027d extarray, overwriting neighboring allocations\u0027 contents and list linkage, which is exactly the class of corruption that yields arbitrary-write and control-flow-hijack primitives.\nA:H - The corruption is confirmed to produce list_del corruption and SLUB redzone overwrites, causing kernel oops/panic during drm_managed_release on device unbind and unpredictable slab corruption beforehand."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:02:07.998Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b485bfb45555163bfa5f565d6a3415fcb3035b02"
        },
        {
          "url": "https://git.kernel.org/stable/c/a9a020f3c11eba6573b699f9cf9245a51b025ade"
        },
        {
          "url": "https://git.kernel.org/stable/c/632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0"
        }
      ],
      "title": "drm/xe/guc: Fix buffer overflow in steered register list allocation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-68274",
    "datePublished": "2026-08-10T12:01:49.762Z",
    "dateReserved": "2026-07-30T09:28:09.379Z",
    "dateUpdated": "2026-08-17T05:02:07.998Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-68274",
      "date": "2026-09-15",
      "epss": "0.00151",
      "percentile": "0.04578"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-68274\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-10T13:20:16.467\",\"lastModified\":\"2026-08-17T05:18:29.963\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ndrm/xe/guc: Fix buffer overflow in steered register list allocation\\n\\nThe size calculation for the steered register extarray uses only the\\ngeometry DSS mask (g_dss_mask) to determine the number of entries to\\nallocate:\\n\\n  total = bitmap_weight(gt-\u003efuse_topo.g_dss_mask, ...) * steer_reg_num;\\n\\nHowever, the filling loop uses for_each_dss_steering(), which iterates\\nover for_each_dss(), defined as the union of g_dss_mask and c_dss_mask\\n(geometry + compute DSS). On platforms with compute-only DSS bits, the\\nloop writes past the allocated buffer, corrupting adjacent slab objects.\\n\\nThis manifests as list_del corruption and SLUB redzone overwrites during\\ndrm_managed_release on device unbind, since the overflow corrupts the\\ndrmres list_head of neighboring allocations.\\n\\nFix by computing the allocation size using the union of both DSS masks,\\nmatching the iteration pattern of for_each_dss_steering().\\n\\n--\\nv2:\\n- use bitmap_weighted_or() (Zhanjun)\\n\\n(cherry picked from commit 0a78a44f4901aa6c9263e66be7fce02282f1109f)\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_capture.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b170d696c1e2226713471d810c63b1162335079f\",\"lessThan\":\"b485bfb45555163bfa5f565d6a3415fcb3035b02\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b170d696c1e2226713471d810c63b1162335079f\",\"lessThan\":\"a9a020f3c11eba6573b699f9cf9245a51b025ade\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b170d696c1e2226713471d810c63b1162335079f\",\"lessThan\":\"632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/gpu/drm/xe/xe_guc_capture.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.13\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.13\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/632ecc90e1ca5d3b6822bb4d08f84a175b6c42c0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a9a020f3c11eba6573b699f9cf9245a51b025ade\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b485bfb45555163bfa5f565d6a3415fcb3035b02\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-31T11:20:35+00:00",
      "cve": "CVE-2026-68274",
      "id": "CVE-2026-68274",
      "initial_release_date": "2026-08-10T00:00:00+00:00",
      "product_status:known_affected": "182",
      "product_status:known_not_affected": "95",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: drm/xe/guc: Fix buffer overflow in steered register list allocation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-68274.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:37:27Z",
      "cve": "CVE-2026-68274",
      "id": "CVE-2026-68274",
      "initial_release_date": "2026-08-14T17:14:44Z",
      "product_status:known_affected": "12",
      "product_status:known_not_affected": "362",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-68274",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-68274.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.